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AMENDMENTS TO THE SPECIFICATION 

Please replace the paragraph at page 6, from lines 19-21, with the following paragraph: 

Figs. 3A, 3B, 4A and 4B are flow diagrams detailing a process in accordance with an 
embodiment of the present invention, and detail elements of the respective processes in 
accordance with standard programming conventions; 

Please replace the paragraph at page 6, line 29 to page 7, line 7, with the following 
paragraph: 

Fig. 1 shows an exemplary data structure representing a Direct CycUc Graph (DCG), that 
will be used in describing an exemplary packet classification process in accordance with the 
invention. This Direct Cyclic Graph (DCG) is used to store all the information related to a 
classification process, such as that shown in Figs. 3A and 3B and Figs. 4A and 4B, and detailed 
below. The DCG has interconnected edges and nodes. Each edge of a graph has a special pattern 
(detailed below) associated with it. Each node has a unique number assigned to it, which is used 
to represent path in a DCG. When a pattem matches a packet being classified, it means that this 
DCG can be traversed to the next connecting node. 

Please replace the paragraph at page 9, from lines 11-13, with the following paragraph: 

An optional expire flag indicates the time period (in milliseconds) after which the loaded 
cell value must be discarded (expired). If not specified, a default expiration value of 60000 
should be used. 

Please replace the paragraph at page 15, lines 4-11, with the following paragraph: 

Turning also to Figs. 3A and 3B, there is detailed a process, in the form of a flow 
diagram, in accordance with an embodiment of the present invention. The process of Figs. 3 A 
and 3B will be described with respect to the DCG of Fig. 1, with the numbers of the nodes 
corresponding thereto. This process is typically passive, as it typically does not modify packet 
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data. The process results in incoming packets being classified in accordance with their individual 
characteristics as well as those of its data flow. The classification process as described herein is 
such that it modifies the DCG data dynamically and continuously (on-the-fly). 

Please replace the paragraph at page 15, lines 23-27, with the following paragraph: 

Alternately, if the list is not empty, as there are outgoing edges, the pattern is taken in 
accordance with its order on the list at block 110. The pattern includes seven expressions, known 
as exprO, . . ., expr6. The first expression (exprO) is then calculated at block 1 12. The calculation 
process of block 112 will now be described by reference to Figs 4A and 4B. 

Please replace the paragraph at page 17, lines 16-21, with the following paragraph: 

exprO has now been calculated, in accordance with flow diagram of Figs. 4A and 4B, and 
if false, the process moves to block 114 (Fig. 3 A), where packet state is looked up in a state set 
(as shown on Fig. 2). The number of the set used for this lookup is specified by pattem's variable 
set as described above. At block 116, if the lookup was successful, i.e. a value for packet state 
was located, the process moves to block 130. Altemately, if the lookup was unsuccessfiil, the 
process retums to block 110. 

Please replace the paragraph at page 17, lines 22-25, with the following paragraph: 

Returning to block 112, if exprO has been calculated to be true, the process moves to 
block 120, where all remaining expressions of the pattem (if any) are calculated according to the 
process of Figs. 4A and 4B. Regardless of any other pattem expressions and their results, the 
process moves to block 130. 

Please replace the paragraph at page 18, lines 20-24, with the following paragraph: 

Tuming now to Fig. 5, there shown a Classification Engine (CE) 300 on which the 
processes of embodiments of the invention, for example, as shown in Figs. 3A and 3B and Figs. 
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4A and 4B, and described above, can be performed. Typical operating systems employing this 
engine 300 utilize kemel space 302, separate from user space 304. 

Please replace the paragraph at page 40, lines 20-24, with the following paragraph: 

This example is directed to an implementation of the process detailed in Figs. 3 A and 3B 
and Figs. 4A and 4B. This example details memory requirements and execution time of the 
aforementioned process. For this particular implementation, to ensure high performance of the 
algorithm and to maintain a minimal memory footprint, the following rules were applied. These 
rules were as follows: 
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